CORS Misconfiguration Checker

How it works

Cross-Origin Resource Sharing mistakes are a classic way browsers become an API proxy for attackers. We send a probe Origin header to your public URL and inspect Access-Control-Allow-Origin and Access-Control-Allow-Credentials. Reflection of an arbitrary origin, wildcard ACAO especially with credentials, and related smells lower the grade.\n\nMany marketing sites show “no ACAO” - that is often fine. The interesting cases are JSON APIs and authenticated app origins that echo Origin or use * carelessly. This teaser hits a single URL; it does not enumerate every API route or preflight combination. Path-specific CORS configs can look safe on / and unsafe on /api.\n\nIf you see origin reflection with credentials, treat it as high priority: fix the allowlist, avoid reflecting untrusted Origin values, and re-test. Then run a full AtRisk scan to catch other browser-side and transport issues on the same host.\n\nSSRF protections keep this checker pointed at public hosts only. Not a pentest - a focused misconfiguration smell test for founders shipping fast. SPA backends and serverless functions are frequent offenders because templates enable CORS broadly during local development and the setting ships. Prefer an explicit allowlist of front-end origins, never reflect arbitrary Origin values, and keep credentials off unless strictly required. After a fix, re-probe this URL and any /api routes you expose publicly. Combine with Cookie Security Checker when credentials are involved.

This is a free teaser check - not a penetration test, vulnerability assessment, or compliance audit. AtRisk full scans go deeper across more detectors and unlock fix prompts on Starter.